Instructor: Right, so the first step 2 2
into the server-side attacks is information gathering. 3 3
Information gathering is very important 4 4
because it will show us the operating system of the target, 5 5
the installed programs or the running services 6 6
on the target, the ports associated with the services. 7 7
Now from these installed services, 8 8
we can try and get into the system. 9 9
We can do this by trying the default passwords 10 10
and we've seen this before 11 11
in the network penetration testing part 12 12
where the iPad had SSH service installed, 13 13
which basically give you full access to the computer 14 14
if the person still uses the default password, 15 15
which was alpine. 16 16
So we can do this with any other service 17 17
and we'll see another example here today. 18 18
Another thing that we can do is there's a lot of people 19 19
that install services and misconfigure them. 20 20
So we'll have another example of this. 21 21
So sometimes a lot of these services are designed 22 22
to give some remote person some access to that computer 23 23
but they obviously 24 24
need to have some security implementations. 25 25
People often misconfigure these services 26 26
so we can take advantage of these misconfigurations 27 27
and gain access to these computers. 28 28
Another problem with these services, 29 29
some of them might even have backdoors 30 30
and we'll see an example of that. 31 31
And a lot of them would have vulnerabilities 32 32
such as remote buffer overflows 33 33
or code execution vulnerabilities that allow us to again, 34 34
gain full access to that computer. 35 35
Now, the simplest way on doing this is something 36 36
that we've seen before which is using Zenmap. 37 37
So we use Zenmap using the IP, we get a list 38 38
of all of these services and then google maybe each one 39 39
of them and see if they contain any vulnerabilities. 40 40
Now we've seen how we use Zenmap before 41 41
but I just wanna convey the idea of anything is a computer 42 42
and we've seen before how the Metasploitable device, 43 43
this device is actually a website, 44 44
it has a web server running. 45 45
So websites are nothing different than this. 46 46
If you want to get an IP of a website, all you have to do 47 47
is just do a ping, so for example, 48 48
if we're targeting Facebook, so all we have to do 49 49
is do ping facebook.com and we'll get their IP right here. 50 50
So we have Facebook's IP and we'll be able 51 51
to run Zenmap against it and gain a list 52 52
of all the running services on Facebook. 53 53
Now, obviously, I'm not gonna do that 54 54
because I'm not allowed to do that, what I'm going to do is 55 55
I'm gonna run Zenmap against this Metasploitable device, 56 56
which basically is a computer device 57 57
and that's what we're interested into testing. 58 58
So again, I can't really stress this anymore, 59 59
anything is a computer, whether it's a website, a server, 60 60
any online service, a phone, anything is a computer 61 61
so you can go about penetration anything the same way. 62 62
So I'm gonna run Zenmap just with, this is the same way 63 63
that we did before so I'm gonna go on my activities, 64 64
I'm just gonna look for Zenmap and here is Zenmap 65 65
and I'm gonna put the IP of my target 66 66
of the Metasploitable device, which was 10, 14, 04. 67 67
So remember, in the network penetration testing part, 68 68
we used to put the base IP and put it over 24 69 69
to cover all the IPS around us in the network. 70 70
In this case, you might be testing a remote IP 71 71
so for example, in the Facebook case, all we have to do 72 72
is just put the Facebook target IP in there and test it. 73 73
Now that's granted that you have permission to do that. 74 74
Now I don't have permission so I'm not gonna do that. 75 75
What I have permission to do is test my own device 76 76
which is installed on the same network as me 77 77
so that's why I'm putting that IP but you can literally put 78 78
any IP you want in there and test it. 79 79
So I'm gonna hit on scan 80 80
and this will give me a list of all 81 81
the installed applications. 82 82
Okay, so the scan is finished now and 83 83
we have a lot of open ports, a lot of services. 84 84
What I advise you to do in this case now if you wanna do 85 85
a simple test is you literally go on ports, port by port, 86 86
read what it is and google the name of the program. 87 87
So for example, we have port 21 here, that's an FTP port. 88 88
FTP is a service that allow, it's installed to allow people 89 89
to upload or download files from the remote server. 90 90
So we can see, usually FTP services use a username 91 91
and password but you can see that this service 92 92
has been misconfigured and it allows anonymous FTP login. 93 93
So unlike the SSH that we used before 94 94
in the network penetration testing we had, 95 95
we use the default password. 96 96
With this you'll be able to log in without a password. 97 97
So all we have to do is download an FTP client 98 98
such as FileZilla and you'll be able to connect 99 99
using this IP address on port 21. 100 100
Now I'm not gonna explain this 'cause it's very simple, 101 101
you literally download the application and connect to it. 102 102
What else you can do is you can google this, you can, 103 103
this is an FTP server, you can literally google this 104 104
and see if it has any issues, 105 105
if it has any misconfigurations, 106 106
if it has any known code execution exploits. 107 107
So I know if you google this now, 108 108
this particular application has a backdoor installed 109 109
with it so it literally came with a backdoor 110 110
when it was released. 111 111
For now, I'd like to show you something simpler 112 112
just so that we make this shorter. 113 113
So as I said, you need to go in one by one, 114 114
googling the services and checking 115 115
if they have any misconfigurations or any exploits installed 116 116
or if any known exploits. 117 117
So what I'm going to do now is 118 118
I'm gonna have a look on the 512. 119 119
So let's assume we went on them one by one, 120 120
we couldn't find anything and we reach the 512 TCP port. 121 121
So I'm gonna copy this, this is the service 122 122
that's running on this port. 123 123
So literally, I don't know what's this so I'm gonna copy it, 124 124
go on Google and google it. 125 125
Okay, so we're gonna have a look 126 126
on the first result that we got here. 127 127
And we can see that this is a remote execution program 128 128
so that's very nice, that's very cool. 129 129
So if we manage to log in with this, we'll have, 130 130
we'll be able to execute commands on the target computer 131 131
and it uses the RSH rlogin, that's a program that ships 132 132
with Linux that allows you similar to SSH you get in a way 133 133
that lets you execute remote commands 134 134
on the target computer. 135 135
So let's go back and see how we can connect to this. 136 136
So this is all cool. 137 137
So let's see the package, what comes in with this package? 138 138
So and you can see, this is Ubuntu 139 139
so the target's computer system was running on Ubuntu. 140 140
If we go back, so it's running on Ubuntu here. 141 141
And you can see that in here, 142 142
it uses the RSH client service to connect. 143 143
So this is the package that you need to install 144 144
to connect to this service. 145 145
So and as you can see, it says client program 146 146
for remote shell connection. 147 147
So go, go back and let's install RSH client. 148 148
So we usually as we did before, when we need 149 149
to install something, we do apt-get and we do install 150 150
and we'll write the name of the program 151 151
that we want to install, so it's RSH. 152 152
Now apt-get is gonna install it for me and configure it 153 153
and once it's installed, we're gonna use rlogin 154 154
to log in because remember the first page told us 155 155
that it uses the rlogin program to facilitate login process. 156 156
So I'm gonna do rlogin and again, I don't know 157 157
how to use this app so I'm gonna do the help 158 158
to see how to use it and we can see that the format 159 159
is rlogin, you put the options that you want 160 160
so what's important here is the username and the host, 161 161
which is the target IP. 162 162
So this is what we're gonna do, we're gonna do rlogin, 163 163
we're gonna put the username as root. 164 164
Again, we said root is the user 165 165
with the most privileges on the system. 166 166
And we'll put the target IP which is 10, 20. 167 167
Now as you can see now, we are logged in 168 168
to the Metasploitable machine here 169 169
and if I do ID to get my ID, you can see that I am root. 170 170
If I get where I am pwd, I'm in the root directory, 171 171
I can list stuff. 172 172
If I do a uname -a data list, the hostname 173 173
and the kernel that's running on the machine 174 174
and as you can see that I am 175 175
in the Metasploitable machine with root access. 176 176
So this was a manual way, a basic way of gaining access 177 177
to the target computer only by a misconfiguration 178 178
of an installed service. 179 179
So the rlogin service was not configured properly, 180 180
all we had to do is just google what came with that port 181 181
and we managed to find or we managed to log in 182 182
and gain full access to the target computer. 183 183
Now again, the key point here is you do a Zenmap scan 184 184
and then you go on each port that you find, 185 185
you google that port and you'd be looking 186 186
for misconfigurations, default passwords, 187 187
if this target service came in with a backdoor 188 188
or code execution, maybe it just wasn't programmed properly 189 189
or it had a flaw that can be used 190 190
to gain access to that computer. 191 191
Now we'll have examples of these things 192 192
in future videos as well.